This is a cache of https://docs.openshift.com/container-platform/4.12/security/certificate_types_descriptions/user-provided-certificates-for-api-server.html. It is a snapshot of the page at 2024-11-22T11:26:36.483+0000.
<strong>user</strong>-provided certificates for the API server - Certificate types and descriptions | Security and compliance | OpenShift Container Platform 4.12
    OpenShift docs are moving and will soon only be available at docs.redhat.com, the home of all Red Hat product documentation. Explore the new docs experience today.
  1. Documentation
    2. history bug_report picture_as_pdf
×

user-provided certificates for the API server

Purpose

The API server is accessible by clients external to the cluster at api.<cluster_name>.<base_domain>. You might want clients to access the API server at a different hostname or without the need to distribute the cluster-managed certificate authority (CA) certificates to the clients. The administrator must set a custom default certificate to be used by the API server when serving content.

Location

The user-provided certificates must be provided in a kubernetes.io/tls type Secret in the openshift-config namespace. Update the API server cluster configuration, the apiserver/cluster resource, to enable the use of the user-provided certificate.

Management

user-provided certificates are managed by the user.

Expiration

API server client certificate expiration is less than five minutes.

user-provided certificates are managed by the user.

Customization

Update the secret containing the user-managed certificate as needed.

Additional resources